From: Daniel P. Berrangé <berrange@redhat.com>
Date: Fri, 5 Jan 2024 16:09:52 +0000 (+0000)
Subject: chardev: close QIOChannel before unref'ing
X-Git-Tag: v9.0.0-rc0~71^2~8
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cb8ded0f6d919a61ef890be14b28e765fba81f66;p=thirdparty%2Fqemu.git

chardev: close QIOChannel before unref'ing

The chardev socket backend will unref the QIOChannel object while
it is still potentially open. When using TLS there could be a
pending TLS handshake taking place. If the channel is left open
then when the TLS handshake callback runs, it can end up accessing
free'd memory in the tcp_chr_tls_handshake method.

Closing the QIOChannel will unregister any pending handshake
source.

Reported-by: jiangyegen <jiangyegen@huawei.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---

diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index 73947da188d..71057538152 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -378,6 +378,10 @@ static void tcp_chr_free_connection(Chardev *chr)
                                  char_socket_yank_iochannel,
                                  QIO_CHANNEL(s->sioc));
     }
+
+    if (s->ioc) {
+        qio_channel_close(s->ioc, NULL);
+    }
     object_unref(OBJECT(s->sioc));
     s->sioc = NULL;
     object_unref(OBJECT(s->ioc));